| |
Vulnerability CVE-2023-42818
Published: 2023-09-27
| Description: |
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue. |
Type:
CWE-287 (Improper Authentication)
References: |
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jv
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
